Ironically, this problem comes about given secure messaging being linked only to a phone number, operating “over the top,” with no back-end links to a device’s OS or number.

WhatsApp 2FA Enabled On Victim's Phone But Did NOT Prevent Attack WhatsApp / Android Ideally, a move towards being more privacy focused would help protect users from this, as well as forcing people to implement a two-step verification PIN.” “Anyone can type in a phone number to locate the associated account if it exists. “There is no way of opting out of being discovered on WhatsApp,” he warns. This is a much better system and would shut down this vulnerability.Īccording to Moore, this vulnerability has flagged another serious WhatsApp issue. Even more simply, when multi-device access eventually appears, WhatsApp could use the trusted device concept to enable one verified app to verify another. WhatsApp could ensure that an app on a device with 2FA registered can prevent this issue, using 2FA as a circuit breaker. This isn’t complex and should be easily fixed. And this should not work when 2FA is enabled, as was the case on this “victim’s” app.

There are many reasons why it might be advantageous to block someone from their go-to messenger. There is no sophistication to this attack-that’s the real issue here and WhatsApp should address it immediately. Remember, they see the same timer as you.Ĭlearly, the combination of this verification architecture, the SMS/code limits and the automated, keyword-based actions triggered by incoming emails is open to abuse. You will need to contact WhatsApp and try to find someone who can help.Įven if the attacker deactivates your phone during the first cycle, they can push you into a second 12-hour countdown if they request and enter codes at the expiration of the first countdown before you get chance.

“It’s too late,” the researchers told me. Verification countdown errors on both Attacker's and Victim's Phone After 3rd Attack Cycle WhatsApp / Androidīut unfortunately, your phone is treated the same way as the attacker’s-and so, if the attacker waits until now before emailing WhatsApp Support to deactivate your number, there will be no way for you to reregister WhatsApp on your phone when you are kicked out of your app.

Your whatsapp number account be by